lkml.org 
[lkml]   [2018]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subjectproposal for meltdown-workaround with low overhead
Date
Hi all,

This is my first post here and I hope it is fine. I will subscribe
tomorrow to this list, so please take me in CC for answers now.

As Meltdown-Issue depends on allowing to cause many exceptions (usually
: accessing an invalid address), we could restrict this misusage easy.

My rough proposal that should give an idea and some of them in
combination should fix the problem.

Of course root and a special new group could be excluded from these
restrictions. But especially for JIT-Engine, we should be strict here
inside exception handling code.
The normal performance should not be affected, only exception handling
(kernel OS part, not user part) a little.
If an attack is detected (via counter threshold), prevent start new
processes by this user (including forks), or stop/suspend this (or all
existing?) process(es) of this user.

1. Limit the number of this exception kind by a per user counter, as I
don't see a use case for normal operation to cause high frequent memory
probes. (e.g. 1/sec and/or 100 since boot, or similar - configurable
parameters perhaps) And if someone needs this, he needs to get the right
for it (e.g. via new memory_exception_group).
2. Limit the fork count (similar to step 1). Especially JIT-users should
not need (e.g.) >10 forks per sec (again configurable).
3. Perhaps memory transaction (variant) can also be handled somehow via
a sufficieant delay after such exception (e.g. pausing all processes of
same user for some sleep-ms).

Depending on details, this slows down the attack sigificantly and can
even completely prevent it (by hard counter limits for guests or
unpriviliged users).

Let's fight is from the other side.

kind regards,
Alexander


\
 
 \ /
  Last update: 2018-01-04 20:51    [W:0.042 / U:0.832 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site